Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

0
votes
1answer
32 views

Double user-agent. Malware?

The place where I work sometime is receiving some alert from the NIPS stating : [1:30918:2] "MALWARE-CNC User-Agent known malicious user agent - User-Agent User-Agent Mozilla" The user-agent in the ...
1
vote
1answer
97 views

I found an RSA private key on my ransomware-infected device. Can I use it to decrypt the files?

I have ransomware on my laptop. I ran Spyhunter and deleted as much as I could. I found an RSA in the Windows registry with regedit. Then, as I was checking for unknown files, I found a .android file ...
5
votes
1answer
142 views

I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is [duplicate]

This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing: What is this process? How can I get ...
0
votes
0answers
62 views

Insecure data storage extraction through malicious app [on hold]

I want to know how can I extract insecure data of third application in rooted phone remotely. I have read in https://www.owasp.org/index.php/Mobile_Top_10_2014-M2 that malicious application can access ...
2
votes
1answer
69 views

Can a USB with an infected MBR or GPT harm an OS that reads it?

Assume a USB drive has an MBR or GPT that has malware in it. I already understand that booting from such a USB device would execute the malware as part of the bootloader. If I understand correctly, if ...
0
votes
0answers
36 views

Strange internet traffic on CentOS. Am I infected?

I have CentOS 7 VPS and when I entered lsof -i command I've seen some strange connection: sshd 26422 root 3r IPv4 1081208 0t0 TCP jabber.darkserver.in:ssh->89-64-44-49.dynamic....
0
votes
0answers
52 views

Where should I look for 'Location' header malicious redirect? Linux, php

My site was hacked and now it responses with 'Location' header redirecting to the malicious site, but does this only for mobile clients. I wasn't able to find the malicious code yet and I'd like you ...
-1
votes
0answers
58 views

Can I get in trouble for making a malware? [closed]

I'm making a malware software in my final thesis at the university. I won't use it ever, and it was made by educational and scientific purposes only. But my university will publish it, giving the ...
0
votes
1answer
64 views

How to back up and restore personal data safely from possibly exploited android phone

I'm using a Samsung J7 Prime with Android version 7.0, not rooted. Recently, I grew suspicious I had become the target of some kind of exploit/network attack/mitm. Since I suspect the exploit is ...
0
votes
2answers
96 views

Well what exactly is the difference between a virus and just plain old malware? [duplicate]

Like is malware just a computer virus or is it something completely different? I am just curious, I did watch a video on it and it did not really give me my answer that i wished for.
-2
votes
0answers
76 views

What does this PHP malware do? [duplicate]

Somebody hacked my site and uploaded this script (rootfunctions.php) to my webroot and its content is: PHP Code: https://pastebin.com/raw/a889iG0V Hopefully, I have removed this malware from my ...
-2
votes
1answer
64 views

what is metasploit framework even used for? [on hold]

I know how the Metasploit framework works and I know that it can generate payloads and such, my question is if there is a way to evade anti-virus using Metasploit payloads. What exact purpose does it ...
0
votes
0answers
44 views

Cuckoo sandbox vs VM introspection for malware analysis

I'm trying to dig a bit more into dynamic malware analysis and currently need to decide which tool to use. Cuckoo sandbox looks like the standard but it is certainly easier to detect than ...
0
votes
1answer
34 views

How to protect UEM (Unified Endpoint Management) agent on your endpoint

A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "...
0
votes
1answer
89 views

Potential UEFI malware from Virus Total .rom scan

I dumped my firmware on my Macbook with Darwin Dumper and uploaded the .rom file to Virus Total and it showed a huge amount of bad PE32 images (File detail tab), all of which seem to be detected by ...
3
votes
2answers
67 views

Malware spreading via installation media

Imagine user downloads and burns installation USB stick on their compromised Linux system. Are there any known malware that is capable of spreading via Linux distributions installation media so that ...
0
votes
1answer
50 views

Is Browser-Update A Legitimate Site?

I searched this site to find if the following site is legitimate and didn't see any posts. A legitimate company is linking to this site on their front page with a warning - the site linked to: ...
0
votes
1answer
56 views

Can my PC get infected by a shared USB drive?

I gave one of my flash drives to a co-worker to share some files. He transferred the files to his computer and gave me back the drive a minute later. Is it possible for my computer to have been ...
1
vote
0answers
18 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
1
vote
1answer
60 views

Qubes OS or TENS for security? Is Qubes a good idea for a total beginner? [on hold]

What would be the most appropriate to use for as much security as possible? TENS looks very simple and straightforward, which is why I like it. However I have barely seen anyone suggesting it, I ...
0
votes
1answer
57 views

How can I safely use potentially infected USB sticks from a previous OS installation?

So I recently upgraded an old MB Pro to Mojave because I was concerned I could've infected it. Now I'm probably overreacting to all of this but since I was using all of my USB sticks in the previous ...
1
vote
1answer
112 views

What is “Waiting for eb2.3lift.com…”?

I am using purevpn on Firefox, I have noticed that when I open the browser sometimes it hangs and on the bottom left hand corner it says "Waiting for eb2.3lift.com..." I tried to google this eb2....
0
votes
2answers
89 views

Is Kaspersky Total Security a good choice against malware? [closed]

I've been using Kaspersky Total Security for quite some time even though I'm not an Information Security professional, I heard it was considerably efficient. Yesterday, though, I was navigating ...
0
votes
0answers
6 views

Is it a crime if someone inserts ads inside an existing software? [migrated]

If you search on Internet, you would be able to find apps that are modified to insert code that shows ads here and there. For example, you can take the official WhatsApp Android APK and insert code to ...
0
votes
2answers
132 views

Could my computer have downloaded some sort of virus or malware after clicking this button?

I went to the website: katsokos.com, and was shown this page: I stupidly clicked on the verification button and was redirected to the chrome store page for some chrome plugin, as well as the website ...
1
vote
1answer
81 views

Send GET request from a PDF file

I'm currently working on a security Proof Of Concept where I need to show the danger of opening an unknown PDF file. Internet says that many malwares use Javascript in PDF document (AcroJS) to ...
1
vote
2answers
91 views

How can I securely edit an Office file that I downloaded from the Internet?

When I open an Office file such as a Word file that was downloaded from the internet, it warns me that it might not be safe to edit unless I trust the file source, but what if I actually need the file ...
1
vote
0answers
121 views

Weird Python script found on a Mac Os X client machine

I was reviewing a Mac Os X machine (a late 2016 MacBook Pro) and I found some weird scripts in the LaunchAgent folder. 8 -rw-r--r-- 1 XX wheel 500 30 Lug 07:18 com.1e1zq.plist 8 -rw-r--r-- 1 XX ...
1
vote
1answer
197 views

Potential router malware? Receiving “Access Denied” and other weird blocks from various websites

So I've been having some weird browsing behavior over the last few weeks and it's gotten a lot worse the last few days. I've been getting blocked/banned by various websites off and on. Here are a few ...
2
votes
1answer
90 views

I found a browser extension I don't trust installed, should I worry?

Someone told me that their Firefox had a strange new menu bar. I found that it was “FindYourMaps”. FindYourMaps is a deceptive browser toolbar that supposedly allows users to find driving ...
0
votes
0answers
35 views

How to divert hard-coded IP requests using FakeNet-NG?

I started studying malware analysis. I've used apateDNS and INetSim to simulate external services and now I'm trying FakeNet-NG, but I'm struggling to perform a very basic operation. How is it ...
2
votes
3answers
299 views

New user with Chinese name appeared on MacOS. Hacker?

I'm the only user on my personal laptop (MacBook Pro) running macOS Sierra. I discovered today that a suspicious user with a Chinese name appeared next to mine in the finder. Please see the attached ...
60
votes
5answers
16k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
0
votes
2answers
60 views

If a host is infected is the sandbox environment infected?

Say my host machine is infected and I have a sandbox program. Will that sandbox environment then be infected also? If the answer is yes, what if I have an AV running inside of the sandbox. Will it ...
0
votes
0answers
24 views

WordPress javascript code injection [duplicate]

Google notified me that there are malicious links on my website: https://cobalten.com/apu.php?zoneid=2025634 https://go.oclasrv.com/apu.php?zoneid=2025634 https://wowreality.info/page.js?wm=gr It's ...
3
votes
1answer
50 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
0
votes
1answer
75 views

How can you reset a UEFI completely in case of a firmware infection?

I haven't really understood whether firmware level infection (on either motherboard or drives) can actually be a thing without physical access, however how can one factory reset the firmware in that ...
2
votes
0answers
39 views

Search function in Outlook and attachements

I am wondering how the search function of Outlook is working, especially in regards to researching key words that are presents in emails attachements. Does the Outlook search function opens the files ...
1
vote
2answers
110 views

If C uses shared libraries, is it possible to write a program that will modify the code that opens a file

If C uses shared libraries, is it possible to write a program that will modify the fopen function to execute a malicious code? How can the OS protect the user from this?
1
vote
2answers
86 views

What files can I keep to reinstall an infected system without getting infected again?

I'm quite sure my Windows PC is infected beyond salvation and I want to format it and reinstall everything. However, I have a 128 GB SSD where I keep only the OS and a 1 TB hard disk where I have ...
3
votes
1answer
65 views

Remove malicious rootkits and spyware from HDDs and SSDs

I have read at least twenty articles dating from the time Edward Snowden's startling revelations about rogue nations and bad actors embedding malicious rootkits and spyware in the firmware of hard ...
1
vote
0answers
36 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
2
votes
1answer
48 views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
1
vote
3answers
94 views

is spoofing CA to sign application possible?

Is it possible to spoof the CA of any server to sign some application? As like as what CarbonCopy claims?
40
votes
5answers
5k views

How should source code security be checked?

How to check whether the source code of an open-source project contains no malicious content? For example, in a set of source code files with altogether 30,000 lines, there might be 1-2 lines ...
0
votes
2answers
49 views

What type of malware can see my browsing activity?

I downloaded and installed Malwarebytes. After running a scan, Malwarebytes quarantined a bunch of different malware programs. What type of malware can see my browsing history, my Google searches ...
1
vote
0answers
81 views

Malware Author's Mindset

I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life ...
2
votes
2answers
135 views

How to harvest plaintext passwords from emails

Do you have any links to stories from a reputable source about any malware that harvests plaintext passwords from emails? I do tech support and every once in a while one of my clients will send me ...
-1
votes
1answer
122 views

Explain how a BIOS/UEFI infection may compromise the security of the Operating System [closed]

Explain how a BIOS/UEFI infection may compromise the security of the Operating System.
0
votes
0answers
38 views

Malware host-based signature [duplicate]

Wondering how anti-malware companies (especially those using signature based detection solution) create a signature for the malware or bad files. Do they just make a hash for the whole file? because ...